TinkerNothing run yet.the code runs in the sandbox · files: working copy writable, data read-only, keys hidden · network: open · secret: in the sandbox
Chapter 3 of 7
Network
Files are one wall; the network is the other. In chapter 1 the attack’s last move was a request to an outside host. That is how data leaves. Now set what the sandbox can reach.
This chapter: With egress off, then an allow-list through a proxy, what can the agent reach?
You will learn
- Egress: the agent’s outbound network, which can be off, open, or an allow-list
- How a proxy lets only allow-listed hosts out and blocks the rest
- Why too tight an allow-list blocks the real task, and the trade-off that makes
Words you’ll meet (4)
- Egress
- Outbound network access: the requests the agent can send out of the sandbox.
- Proxy
- The sandbox allows internet access only through a unix domain socket connected to a proxy server outside the sandbox; the proxy restricts which domains a process can reach and confirms newly requested ones.
- Allow-list
- The only hosts the proxy lets requests reach; everything else is blocked.
- False block
- An ordinary task the defences stop: a real request the allow-list refused.
The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.
Step 1 of 5
The exfiltration attack again, but now the egress is open: the agent can reach any host. Run it and watch the token leave for attacker.example.